Extracted

Extracted

• • Target
    jaffacakes118_Trojan.Win32.DelfInject.zcr.8a6d6205558fd78012a34f6cc8683b94
  • Size 2.0MB
  • SHA256 0f627051ad4dd777fe08aed39398f25eba435e592d2b1a4c0324c41acf401727
  • MD5 8a6d6205558fd78012a34f6cc8683b94
  • SHA1 627486972d5a81de83b31b96b412017a763a1f36
  • SHA512 18975cb1ef41aa4a21052c89a0eb82efd49d6f59d031aa96f5f77f4625f5ec05e1b4f9ee738dc37acb36d79e1cca6d5d01f1b5fa58acfc0a3e1e70c44e5884ed
  • SSDEEP 49152:wA635oJuAsONnTd2uR5n8cem3Tw+XQtLoBp88pyq95h1v:wA6+onONnkGtT3h5H8q9R
  • TLSH
    T19FA533C7E2805393D7A425F7AF27DEA3E954DE2499F95186E8433D32E0B01560038BAE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionadwindlokibotxtremeratpersistenceprivilege_escalationratspywarestealertrojanupx

  • Class file contains resources related to AdWind

  • Detect XtremeRAT payload

  • Family: AdWind

    A Java-based RAT family operated as malware-as-a-service.

    trojanadwind

  • Family: Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Family: XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2